Frequency converter system safety protection method for controller redundancy configuration

Abstract

The invention discloses a controller redundancy configuration-oriented frequency converter system safety protection method, relates to the technical field of frequency converter safety protection, and aims to solve the technical problem of how to comprehensively consider system switching and application occasions of system redundancy aiming at the design of a frequency converter system with controller redundancy. The controllers adopt an optical fiber communication mode or other high-speed communication modes, each set of controller adopts an independent control power supply to supply power, is provided with independent voltage, current and other sampling sensors and circuits, and can realize frequency converter working state synchronization, data intercommunication, master and slave controller authority switching, cooperative protection and the like.

Description

Technical Field

[0001] This invention relates to the field of inverter safety protection technology, specifically to a method for inverter system safety protection with redundant controller configuration. Background Technology

[0002] With industrial upgrading and increasing demand for domestic substitution, high-voltage frequency converters are being used more and more widely in key areas, which also raises the requirements for their operational reliability. In key areas, the use of frequency converters to replace the power grid can lead to huge economic losses if problems occur. Frequency converter manufacturers are actively exploring ways to improve the operational reliability of frequency converters through device redundancy and controller redundancy. However, this increases system complexity and also brings certain control and protection challenges. Therefore, it is crucial to develop a protection strategy for frequency converter systems with controller redundancy in order to both improve the continuous operational reliability of frequency converters and protect their equipment safety.

[0003] Therefore, in the design of frequency converter systems with controller redundancy, there are technical issues regarding how to comprehensively consider system switching and system redundancy applications. In addition, there are technical deficiencies in how to balance system operation safety and redundancy reliability. Summary of the Invention

[0004] The purpose of this invention is to solve the problems mentioned above by proposing a safety protection method for inverter systems with redundant controller configuration.

[0005] The objective of this invention can be achieved through the following technical solution: a safety protection method for inverter systems with redundant controller configurations, comprising the following steps: Step 1: Determine the master / slave permissions of the controller; Step 2: Determine whether the protection logic has been triggered; Step 3: Determine the type of protection; Step 4: Processing logic for different protection types.

[0006] Furthermore, the master-slave permission determination process for the controller in step one is as follows: If the current controller determines that it has host privileges, then the host privilege protection logic will be executed. If the current controller determines that the user has slave privileges, then the slave privilege protection logic will be executed.

[0007] Furthermore, the process for determining whether the protection logic is triggered in step two is as follows: When the current controller is in host privileges, scan whether the host privilege protection logic is triggered. If the host privilege protection logic is not triggered, return. If the host privilege protection logic is triggered, continue to determine the protection type. When the current controller is in slave privileges, scan whether the slave privilege protection logic is triggered. If the slave privilege protection logic is not triggered, return. If the slave privilege protection logic is triggered, continue to determine the protection type.

[0008] Furthermore, the process for determining the protection type in step three is as follows: When the current controller is in master privileges, it sequentially checks whether it is a two-to-one fault, a two-to-two fault, a master-slave switching fault, or an alarm; when the current controller is in slave privileges, it sequentially checks whether it is a fault or an alarm.

[0009] Furthermore, the specific processing logic for different protection types in step four is as follows: When the current controller is in host privileges, it first determines whether a two-choice fault has occurred. If a two-choice fault occurs, it will directly execute the inverter lockout and fault information recording, then disconnect the input and output switches, and issue a comprehensive fault to the user. When there is no two-to-one fault, it will continue to determine whether there is a two-to-two fault. When a two-to-two fault occurs, if the slave is also in a fault state according to the slave feedback status, the inverter will be locked and the fault information will be recorded directly. Then the input and output switches will be disconnected and a comprehensive fault will be sent to the user. If there is no 2-to-2 fault or a 2-to-2 fault exists but the slave device is not faulty, the system will continue to determine whether a master-slave switching fault exists. When there is no master-slave failover, the system will continue to check for alarms. If an alarm is detected, the alarm information will be recorded and a comprehensive alarm output will be sent to the user. If no alarm is detected, the system will return to its previous state.

[0010] Furthermore, when the current controller is in slave mode, it first determines whether there is a fault. If there is a fault, the slave controller records the fault and then transmits the protection status to the host controller for comprehensive alarm output to the user. If there is no fault, it continues to determine the alarm status. If there is an alarm, it records the alarm and transmits the protection status to the host controller for comprehensive alarm output to the user.

[0011] Furthermore, the master-slave switchover fault diagnosis process is as follows: When a master-slave failover occurs, the master-slave failover logic will be executed automatically. The controller's master privileges will eventually switch to slave privileges. When the failover occurs, the fault information will be recorded. The fault status under slave privileges will be transmitted to the new master and a comprehensive alarm will be generated and output to the user.

[0012] Compared with the prior art, the beneficial effects of the present invention are: the inverter system protection method is specifically designed for inverter systems with controller redundancy, taking into account the application scenarios of system switching and system redundancy, and taking into account both system operation safety and redundancy reliability. The invention can be extended to multi-controller redundancy systems, taking into account the redundancy protection of multiple controllers and increasing the reliability of the control system. Attached Figure Description

[0013] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings.

[0014] Figure 1 This is a topology block diagram of the redundant system for the frequency converter controller of the present invention; Figure 2 This is a control flowchart of the inverter controller redundancy system protection method of the present invention. Detailed Implementation

[0015] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0016] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0017] A safety protection method for inverter systems with redundant controller configurations, wherein the inverter controller redundant system topology of the method is as follows: Figure 1 As shown, it mainly includes controller A, controller B, human-machine interface A, human-machine interface B, power supply A, power supply B and its independent digital quantity detection interface, analog quantity detection interface and communication interface; The controller redundancy system consists of two controllers, which communicate with each other via fiber optic or other high-speed communication methods. Each controller is powered by an independent control power supply, has independent voltage and current sampling sensors and circuits, independent digital input / output control, an independent human-machine interface, and an independent external communication interface. It can realize inverter operating status synchronization, data exchange, master-slave controller permission switching, and collaborative protection. The control flow of the inverter controller redundancy system protection method of the present invention is as follows: Figure 2 As shown, the inverter protection method is executed according to the protection logic, and the specific execution steps include: Step 1: Determine the master / slave permissions of the controller: If the current controller determines that it has host privileges, then the host privilege protection logic will be executed. If the current controller determines that the user has slave privileges, then the slave privilege protection logic will be executed. Step 2: Determine if protection logic is triggered: When the current controller is in host privileges, scan whether the host privilege protection logic is triggered. If the host privilege protection logic is not triggered, return. If the host privilege protection logic is triggered, continue to determine the protection type. When the current controller is in slave privileges, scan whether the slave privilege protection logic is triggered. If the slave privilege protection logic is not triggered, return. If the slave privilege protection logic is triggered, continue to determine the protection type. Step 3: Determine the type of protection: When the current controller is in master privileges, it sequentially checks whether there is a two-to-one fault, a two-to-two fault, a master-slave switching fault, or an alarm; when the current controller is in slave privileges, it sequentially checks whether there is a fault or an alarm. Step 4: Processing logic for different protection types: When the current controller is in host privileges, it first determines whether a two-choice fault has occurred. If a two-choice fault occurs, it will directly execute the inverter lockout and fault information recording, then disconnect the input and output switches, and issue a comprehensive fault to the user. When there is no two-to-one fault, it will continue to determine whether there is a two-to-two fault. When a two-to-two fault occurs, if the slave is also in a fault state according to the slave feedback status, the inverter will be locked and the fault information will be recorded directly. Then the input and output switches will be disconnected and a comprehensive fault will be sent to the user. If there is no 2-to-2 fault or a 2-to-2 fault exists but the slave device is not faulty, the system will continue to determine whether a master-slave switching fault exists. When a master-slave failover occurs, the master-slave failover logic will be executed automatically. The master privileges of the controller will eventually switch to slave privileges. When the failover occurs, the fault information will be recorded. The fault status under slave privileges will be transmitted to the new master and a comprehensive alarm will be generated and output to the user. When there is no master-slave switchover failure, it will continue to check whether an alarm has occurred. If an alarm exists, the alarm information will be recorded and a comprehensive alarm will be output to the user. If no alarm exists, it will return. When the current controller is in slave mode, it first determines whether there is a fault. If there is a fault, the slave controller records the fault and then transmits the protection status to the master controller for comprehensive alarm output to the user. If there is no fault, it continues to determine the alarm status. If there is an alarm, it records the alarm and transmits the protection status to the master controller for comprehensive alarm output to the user.

[0018] In use of this invention, Method 1: Two-way fault protection for the main controller. The software includes a dedicated two-way fault protection structure for defining related protections. This structure is automatically enabled only when the controller is in master control. When the main controller triggers the two-way fault protection, it directly blocks the inverter without checking the slave controller's operating status, disconnects the input and output switches, issues a comprehensive fault signal, and records the fault information. This method primarily targets critical safety protections or user-command-based protections. Critical safety protections include input overvoltage faults, output instantaneous overcurrent faults, and safety relay faults. These faults can easily damage the inverter or motor and require immediate protection. User-command-based protections include emergency stop faults and process faults. These are user-required faults and require rapid response. Method 2: Two-way fault protection for the controller. The software is specifically configured with a two-way fault protection structure for the controller to define relevant protections. It is automatically enabled only when the controller is in slave mode. When the two-way fault protection is triggered by the slave controller, the slave controller will enter a fault state independently and will no longer synchronize with the inverter operating state of the master controller. It also does not have the redundancy switching capability between the master and slave controllers. When the slave controller is in a fault state while the master controller is operating normally, the inverter system will only issue an external alarm to remind the user that the inverter has exited the faulty state of the slave controller. It does not have the redundancy switching capability. This type of protection method is only applicable when the controller is in slave mode and is applicable to all types of fault protection. That is, it will be executed when the slave controller detects any inverter fault.

[0019] Thresholds, preset values, or preset ranges are set for result comparison and analysis to determine whether they are good or bad. The value of these thresholds is determined by a combination of large-scale model analysis of sample data and human experience. They can also be adjusted appropriately based on seasonal or rational factors.

[0020] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to specific implementations. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A safety protection method for inverter systems with redundant controller configuration, characterized in that, The execution steps include: Step 1: Determine the master / slave permissions of the controller; Step 2: Determine whether the protection logic has been triggered; Step 3: Determine the type of protection; Step 4: Processing logic for different protection types.

2. The method for safety protection of a frequency converter system with redundant controller configuration according to claim 1, characterized in that, The master-slave permission determination process for the controller in step one is as follows: If the current controller determines that it has host privileges, then the host privilege protection logic will be executed. If the current controller determines that the user has slave privileges, then the slave privilege protection logic will be executed.

3. The method for safety protection of a frequency converter system with redundant controller configuration according to claim 1, characterized in that, The process for determining whether the protection logic is triggered in step two is as follows: When the current controller is in host privileges, scan whether the host privilege protection logic is triggered. If the host privilege protection logic is not triggered, return. If the host privilege protection logic is triggered, continue to determine the protection type. When the current controller is in slave privileges, scan whether the slave privilege protection logic is triggered. If the slave privilege protection logic is not triggered, return. If the slave privilege protection logic is triggered, continue to determine the protection type.

4. The method for safety protection of a frequency converter system with redundant controller configuration according to claim 1, characterized in that, The process of determining the protection type in step three is as follows: When the current controller is in master privileges, it sequentially checks whether it is a two-to-one fault, a two-to-two fault, a master-slave switching fault, or an alarm; when the current controller is in slave privileges, it sequentially checks whether it is a fault or an alarm.

5. The method for safety protection of a frequency converter system with redundant controller configuration according to claim 1, characterized in that, The specific processing logic for different protection types in step four is as follows: When the current controller is in host privileges, it first determines whether a two-choice fault has occurred. If a two-choice fault occurs, it will directly execute the inverter lockout and fault information recording, then disconnect the input and output switches, and issue a comprehensive fault to the user. When there is no two-to-one fault, it will continue to determine whether there is a two-to-two fault. When a two-to-two fault occurs, if the slave is also in a fault state according to the slave feedback status, the inverter will be locked and the fault information will be recorded directly. Then the input and output switches will be disconnected and a comprehensive fault will be sent to the user. If there is no 2-to-2 fault or a 2-to-2 fault exists but the slave device is not faulty, the system will continue to determine whether a master-slave switching fault exists. When there is no master-slave failover, the system will continue to check for alarms. If an alarm is detected, the alarm information will be recorded and a comprehensive alarm output will be sent to the user. If no alarm is detected, the system will return to its previous state.

6. The method for safety protection of a frequency converter system with redundant controller configuration according to claim 5, characterized in that, When the current controller is in slave mode, it first determines whether there is a fault. If there is a fault, the slave controller records the fault and then transmits the protection status to the master controller for comprehensive alarm output to the user. If there is no fault, it continues to determine the alarm status. If there is an alarm, it records the alarm and transmits the protection status to the master controller for comprehensive alarm output to the user.

7. The method for safety protection of a frequency converter system with redundant controller configuration according to claim 6, characterized in that, The process for troubleshooting master-slave switchover failures is as follows: When a master-slave failover occurs, the master-slave failover logic will be executed automatically. The controller's master privileges will eventually switch to slave privileges. When the failover occurs, the fault information will be recorded. The fault status under slave privileges will be transmitted to the new master and a comprehensive alarm will be generated and output to the user.

Images